CVE-2026-71855: 
Suricata vulnerability analysis and mitigation

CVE-2026-71855 is a flow hash collision vulnerability in Suricata — an open-source network IDS/IPS/NSM engine — that allows an IPv4 and IPv6 flow to be treated as equal when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. This flaw exists in src/flow-hash.c and can cause IPv6 packets to reuse IPv4 flow state (or vice versa), resulting in detection bypass, incorrect flowbit handling, or IP-only bypass. Affected versions include all Suricata releases prior to 7.0.17 and versions 8.0.0 through 8.0.5. The vulnerability was published on September 18, 2026, with patches released in versions 7.0.17 and 8.0.6. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 5.9 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is an incorrect comparison (CWE-697) and type confusion (CWE-843) in Suricata's flow lookup logic within src/flow-hash.c. The CmpFlowPacket, CmpFlowKey, FlowCompareICMPv4, and FlowCompareESP functions compared raw address words, ports, protocol, VLAN, recursion level, and live device — but omitted a check for the IP address family (IPv4 vs. IPv6). When a crafted IPv6 packet's raw address data, ports, and other parameters align with an existing IPv4 flow's hash bucket, Suricata incorrectly matches the two flows. The fix adds an explicit IP family check — (PacketIsIPv4(p) == FLOW_IS_IPV4(f)) — to all affected comparison functions, covering TCP/UDP, ICMP, ESP, and eBPF paths (GitHub Commit 181b3b2, GitHub Commit bc41dcc, GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to craft IPv4 or IPv6 packets that collide with an existing flow in Suricata's hash table, causing the engine to apply incorrect flow state to traffic from a different IP family. This results in detection bypass (Suricata fails to trigger matching rules), incorrect flowbit state (stateful detection logic is corrupted), and IP-only bypass (IP-based detection rules are evaded). The primary impact is a high integrity loss — malicious traffic can pass through a Suricata-protected network segment undetected — with no confidentiality or availability impact to Suricata itself (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is remotely exploitable with no authentication or user interaction required, but exploitation requires careful crafting of packets such that their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align with an existing flow — making it non-trivial. The EPSS score is approximately 0.31%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" with automation rated "no" (GitHub Advisory).

1. Reconnaissance: Identify a network segment protected by a vulnerable Suricata instance (versions < 7.0.17 or 8.0.0–8.0.5) operating in IDS or IPS mode with flowbit-based detection rules enabled.
2. Establish a baseline IPv4 flow: Send legitimate or crafted IPv4 traffic through the monitored network to create an IPv4 flow entry in Suricata's flow hash table, noting the flow parameters (source/destination addresses, ports, protocol, VLAN).
3. Craft a colliding IPv6 packet: Construct an IPv6 packet whose raw 128-bit address data (when interpreted as four 32-bit words) matches the IPv4 flow's address words, and whose ports, protocol, VLAN, recursion level, and live device also match — causing the same hash bucket to be selected.
4. Trigger flow state reuse: Send the crafted IPv6 packet through the monitored network. Suricata's CmpFlowPacket function (pre-patch) will incorrectly match the IPv6 packet to the existing IPv4 flow due to the missing IP family check.
5. Achieve detection bypass: With the IPv6 packet reusing the IPv4 flow's state, Suricata applies incorrect flowbit state to the traffic, causing detection rules that depend on flow state or flowbits to fail, allowing malicious payloads carried in the IPv6 packet to pass undetected (GitHub Advisory, GitHub Commit 181b3b2).

• Network: Unusual mixed IPv4/IPv6 traffic patterns where IPv6 packets share identical port, protocol, and VLAN parameters with established IPv4 flows; crafted IPv6 packets with raw address words that numerically match known IPv4 addresses in the environment.
• Logs: Suricata flow logs showing unexpected flow state reuse across IP families (e.g., an IPv6 packet logged under an IPv4 flow entry); missing or suppressed alerts for traffic that should have triggered flowbit-dependent rules.
• Suricata Stats: Anomalous flow hash collision counters in Suricata's stats output; unexpected drops in alert volume for flowbit-based signatures without a corresponding drop in traffic volume.
• Process/Engine: Suricata reporting incorrect IP family in flow records when correlating with external NetFlow or packet capture data (GitHub Advisory).

Upgrade Suricata to version 7.0.17 (for the 7.0.x branch) or 8.0.6 (for the 8.0.x branch), which add explicit IP family checks in all affected flow comparison functions. The OISF advisory confirms no workarounds are available — patching is the only remediation. Additionally, administrators should review and validate detection rules that rely on flowbit state to ensure they have not been affected by this bypass prior to patching (GitHub Advisory, Suricata 7.0.17 Release).